Privacy Policy

This Privacy Policy (the “Policy”) sets out the procedure for collecting, processing, storing, and protecting personal data of Users of the ExWell service available on the Internet at https://exwell.io (the “Site”). The Policy applies to the User’s interaction with the Site and ExWell Services, including the personal account.

1. Terms and definitions

1.1. Unless the context otherwise requires, the following terms have the meanings set out below:

1.1.1. “Site Administration” means persons authorised by ExWell to organise and control the processing of personal data, including determining the purposes of processing, the composition of data processed, and the operations performed with such data.

1.1.2. “Personal data” means any information relating to an identified or identifiable natural person (data subject), whether identified directly or indirectly.

1.1.3. “Processing of personal data” means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, accumulation, storage, updating (alteration), retrieval, use, disclosure (dissemination, provision, access), anonymisation, blocking, erasure, and destruction of personal data.

1.1.4. “Confidentiality of personal data” means the obligation not to allow their disclosure to third parties without the data subject’s consent or another lawful basis.

1.1.5. “User” means a person accessing the Site and/or using ExWell Services.

1.1.6. “IP address” means a unique network address of a device connected to the Internet and identified under the IP protocol.

2. General provisions

2.1. Use of the Site constitutes the User’s acceptance of this Policy and the personal data processing terms set out in it.

2.2. If the User does not agree with the Policy, they must immediately stop using the Site.

2.3. The Policy applies solely to the exwell.io Site. ExWell is not responsible for the processing of personal data on third-party websites that may be accessible via links published on the Site.

2.4. The Site Administration is not obliged to verify the accuracy of personal data provided by the User and may request supporting information. The Administration may require the User to undergo identity verification (KYC) in the cases provided by ExWell’s AML/KYC Policy. Documents and materials required for identification are processed by a compliance partner; ExWell is not obliged to store scans of identity documents on its own servers. Other account and operations data of the User (including information about prepayment for Services and TRON network energy rental orders) are processed in accordance with this Policy.

3. Subject of the Policy

3.1. The Policy sets out the Site Administration’s obligations to protect personal data provided by the User upon registration on the Site, when using the personal account and the Business API, and in other cases at the Site Administration’s request.

3.2. Upon registration, the User provides, in particular, an email address and a password, as well as other information required to access the account. When using the personal account and/or the Business API, the following additional categories of data may be processed:

a) a TRON network payment address issued for making prepayment;
b) the amount, network, and transaction identifier (txid) of an incoming stablecoin transfer;
c) the unused prepayment balance, and the history of credits and debits;
d) information about TRON network energy rental orders, including the recipient address, volume, price, and status, including third-party addresses (the Partner’s clients) submitted via the Business API;
e) technical data from blockchain infrastructure providers, including transaction status and network confirmation information.

3.3. The User’s personal data are processed confidentially and are not disclosed to third parties, except as expressly provided by this Policy or applicable law.

4. Purposes of processing personal data

4.1. The Site Administration may process the User’s personal data for the following purposes:

4.1.1. identifying the User in order to provide the Services;

4.1.2. providing the User with access to Site and personal-account functionality;

4.1.3. interacting with the User, including sending notices, handling enquiries, and providing the Services;

4.1.4. ensuring security and preventing fraud and other abuse;

4.1.5. verifying the accuracy of information provided;

4.1.6. creating an account and accepting prepayment for ExWell Services at the User’s initiative;

4.1.7. informing the User of the status of cryptocurrency exchange orders and of personal-account operations, including prepayment and TRON network energy rental;

4.1.8. processing payments, providing TRON network energy rental, resolving disputes, and complying with the AML/KYC Policy;

4.1.9. providing customer support;

4.1.10. informing the User of news and promotions — where the User has given consent.

5. Methods and periods of processing. Disclosure to third parties

5.1. Personal data are processed for the period necessary to achieve the purposes of processing, or for other periods established by applicable law, by any lawful means.

5.2. The User agrees to the disclosure of personal data to third parties to the extent necessary to provide the Services and achieve the purposes of this Policy, solely to the following categories of recipients:

a) blockchain infrastructure providers (including node operators and incoming-transfer monitoring services);
b) the TRON network energy rental provider — to whom the energy recipient address and the parameters of the relevant order are disclosed;
c) AML and blockchain analytics services;
d) hosting and communications providers.

Personal data are disclosed only for the stated purposes and only to the extent necessary to achieve them.

5.3. Personal data may be provided to public authorities in the cases and in the manner provided by applicable law.

5.4. The Site Administration takes reasonable organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, dissemination, and other unlawful acts.

5.5. The Site Administration and the User take measures aimed at preventing loss of and unauthorised alteration of personal data.

6. Obligations of the parties

6.1. The User must:

6.1.1. provide information necessary to use the Site and receive the Services;

6.1.2. update the personal data provided when they change.

6.2. The Site Administration must:

6.2.1. process personal data solely for the purposes provided by this Policy;

6.2.2. maintain the confidentiality of personal data, except where disclosure is permitted by applicable law or this Policy;

6.2.3. take measures to protect the User’s personal data;

6.2.4. block personal data upon the User’s or an authorised authority’s request if inaccuracy or unlawful processing is identified — in the manner and within the time provided by applicable law.

7. Dispute resolution

7.1. Before applying to a court, a party that considers its rights to have been infringed shall send the other party a written claim (demand).

7.2. The period for considering a claim is thirty (30) calendar days from the date it is received.

7.3. Disputes not settled by the claim procedure shall be resolved in court in accordance with the applicable law.

7.4. The law of England and Wales (United Kingdom) applies to this Policy, unless otherwise required by mandatory provisions of applicable law.